Web Security Scanner Pro

Web Security Scanner Pro Skill

Skill by ara.so — Security Skills collection.

Expert skill for using Web Security Scanner Pro, a comprehensive Python-based web security scanner with 49 modules for vulnerability detection, WAF evasion, and automated security testing.

What This Project Does

Web Security Scanner Pro (WSA Pro) is an open-source security testing tool that:

• Scans for 49 vulnerability types including XSS, SQLi, LFI, RFI, XXE, SSTI, CSRF, command injection
• Tests CMS platforms (WordPress with 9 modules, Joomla, Drupal)
• Detects misconfigurations in web servers (Apache, Nginx, IIS, LiteSpeed, Tomcat)
• Identifies vulnerable software via built-in CVE database (2024-2026)
• Evades detection with WAF bypass, user-agent rotation, rate limiting, proxy support
• Generates professional reports in HTML, PDF, Markdown, and JSON formats
• Provides REST API for automation and CI/CD integration

The scanner includes advanced SQL injection detection (error-based, boolean-blind, time-based blind, UNION-based) and can identify 9 different WAFs (Cloudflare, Sucuri, ModSecurity, etc.).

Installation

Prerequisites

# Requires Python 3.9+
python --version

# Install from GitHub
git clone https://github.com/miladrezanezhad/web-security-scanner-pro.git
cd web-security-scanner-pro
pip install -r requirements.txt

Dependencies

The project requires these key Python packages:

• requests - HTTP client
• beautifulsoup4 - HTML parsing
• pyyaml - Configuration
• jinja2 - Report templates
• reportlab - PDF generation
• flask - REST API server

Key Commands

Basic Usage

# Interactive mode (menu-driven interface)
python main.py

# Quick scan (4 critical modules)
python main.py quick https://example.com

# Full scan (all 49 modules)
python main.py scan https://example.com

# Specific modules only
python main.py scan https://example.com --modules wordpress,xss,sqli,ssl

# Stealth mode for WAF-protected sites
python main.py scan https://example.com --mode stealth

# Aggressive mode (faster, more detectable)
python main.py scan https://example.com --mode aggressive

# Generate multiple report formats
python main.py scan https://example.com --format html pdf json markdown

# Use proxy
python main.py scan https://example.com --proxy http://127.0.0.1:8080

# Custom rate limiting
python main.py scan https://example.com --delay 2 --timeout 30

Module Categories

# CMS scanning
python main.py scan https://example.com --modules wordpress,joomla,drupal

# Vulnerability testing
python main.py scan https://example.com --modules xss,sqli,lfi,xxe,ssti,csrf

# Server fingerprinting
python main.py scan https://example.com --modules apache,nginx,php,mysql

# Control panel detection
python main.py scan https://example.com --modules cpanel,directadmin,plesk

# SSL/TLS testing
python main.py scan https://example.com --modules ssl,headers

# API security
python main.py scan https://example.com --modules graphql,rest_api,jwt

Configuration

config.yaml Structure

# Core settings
scanner:
  timeout: 30
  max_retries: 3
  threads: 10
  user_agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

# Evasion settings
evasion:
  enabled: true
  user_agent_rotation: true
  random_delay: true
  min_delay: 1
  max_delay: 3
  exponential_backoff: true
  
# Proxy configuration
proxy:
  enabled: false
  http: ""
  https: ""
  socks5: ""
  tor: false
  
# Module configuration
modules:
  enabled:
    - wordpress
    - xss
    - sqli
    - ssl
    - headers
  disabled:
    - aggressive_fuzzing

# Report settings
reporting:
  output_dir: "reports/output"
  default_format: "html"
  include_screenshots: false
  
# CVE database
database:
  auto_update: true
  update_interval: 7  # days
  severity_filter: ["CRITICAL", "HIGH", "MEDIUM"]

Environment Variables

# Set proxy via environment
export HTTP_PROXY="http://127.0.0.1:8080"
export HTTPS_PROXY="http://127.0.0.1:8080"

# API server configuration
export WSA_API_HOST="0.0.0.0"
export WSA_API_PORT="5000"
export WSA_API_KEY="your-secret-key-here"

# Database credentials (if needed)
export DB_HOST="localhost"
export DB_USER="scanner"
export DB_PASS="${DB_PASSWORD}"

Python API Usage

Programmatic Scanning

from core.scanner import SecurityScanner
from core.browser import StealthBrowser
from core.evasion import EvasionEngine

# Initialize scanner
scanner = SecurityScanner(
    target="https://example.com",
    modules=["wordpress", "xss", "sqli"],
    mode="stealth"
)

# Configure evasion
scanner.evasion = EvasionEngine(
    user_agent_rotation=True,
    random_delay=True,
    waf_detection=True
)

# Run scan
results = scanner.scan()

# Access findings
for finding in results.get_findings():
    print(f"{finding.severity}: {finding.title}")
    print(f"  Module: {finding.module}")
    print(f"  Description: {finding.description}")
    print(f"  Remediation: {finding.remediation}")

Custom Module Development

from modules.base import BaseModule

class CustomScanModule(BaseModule):
    """Custom security scanning module."""
    
    def __init__(self, browser):
        super().__init__(browser)
        self.name = "custom_scan"
        self.description = "Custom vulnerability detection"
        
    def run(self, target):
        """Execute custom scan logic."""
        findings = []
        
        # Make HTTP request
        response = self.browser.get(target)
        
        # Check for vulnerability
        if self._check_vulnerability(response):
            findings.append({
                "severity": "HIGH",
                "title": "Custom Vulnerability Detected",
                "description": "Found custom security issue",
                "url": target,
                "evidence": response.text[:200],
                "remediation": "Apply custom fix"
            })
            
        return findings
        
    def _check_vulnerability(self, response):
        """Custom vulnerability detection logic."""
        return "vulnerable_pattern" in response.text.lower()

# Register and use custom module
scanner.register_module(CustomScanModule)

Advanced SQL Injection Testing

from modules.vulnerabilities.sqli import SQLInjectionScanner

# Initialize SQLi scanner
sqli_scanner = SQLInjectionScanner(browser)

# Test specific parameter
result = sqli_scanner.test_parameter(
    url="https://example.com/page.php",
    parameter="id",
    value="1"
)

if result.vulnerable:
    print(f"SQLi Type: {result.injection_type}")  # error, boolean, time, union
    print(f"Database: {result.database_type}")    # mysql, postgresql, mssql
    print(f"Payload: {result.payload}")
    print(f"Evidence: {result.evidence}")

# Advanced time-based detection
time_result = sqli_scanner.test_time_based(
    url="https://example.com/search",
    parameter="q",
    delay=5  # seconds
)

WAF Detection and Bypass

from core.evasion import EvasionEngine

evasion = EvasionEngine()

# Detect WAF
waf_info = evasion.detect_waf("https://example.com")
if waf_info["detected"]:
    print(f"WAF Detected: {waf_info['name']}")
    print(f"Confidence: {waf_info['confidence']}")
    
    # Apply WAF-specific bypass techniques
    evasion.apply_bypass_techniques(waf_info['name'])

# Test bypass effectiveness
bypass_success = evasion.test_bypass(
    url="https://example.com",
    payload="<script>alert(1)</script>"
)

# Supported WAFs:
# - Cloudflare
# - Sucuri
# - Wordfence
# - AWS WAF
# - ModSecurity
# - Akamai
# - Imperva
# - F5 BIG-IP
# - Barracuda

Report Generation

from core.reporter import ReportGenerator

# Initialize reporter
reporter = ReportGenerator(scan_results)

# Generate HTML report with charts
html_report = reporter.generate_html(
    output_file="reports/output/scan_report.html",
    include_charts=True,